krz/aws-summary-report

 1# securityhub.py
 2import boto3
 3import datetime
 4from tabulate import tabulate
 5
 6
 7def get_section(config):
 8    profile = config["aws"].get("profile")
 9    region = config["aws"]["region"]
10
11    session = boto3.Session(
12        profile_name=profile if profile else None, region_name=region
13    )
14    client = session.client("securityhub")
15
16    findings = []
17    paginator = client.get_paginator("get_findings")
18
19    response_iterator = paginator.paginate(
20        Filters={
21            "CreatedAt": [{"DateRange": {"Value": 1, "Unit": "DAYS"}}],
22            "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}],
23            "WorkflowStatus": [{"Value": "NEW", "Comparison": "EQUALS"}],
24        },
25    )
26
27    for page in response_iterator:
28        findings.extend(page.get("Findings", []))
29
30    rows = []
31    for finding in findings:
32        title = finding.get("Title", "No title")
33        severity = finding.get("Severity", {}).get("Label", "UNKNOWN")
34        product = finding.get("ProductName", "Unknown Product")
35        resource = finding.get("Resources", [{}])[0].get("Id", "Unknown Resource")
36        rows.append([severity, title[:50], product, resource[:30]])
37
38    if not rows:
39        lines = [
40            "AWS Security Hub Findings (Last 24h)",
41            "No new findings in the past 24 hours.",
42        ]
43    else:
44        table = tabulate(
45            rows,
46            headers=["Severity", "Title", "Product", "Resource"],
47            tablefmt="simple_grid",
48            colalign=("center", "left", "left", "left"),
49        )
50        lines = [
51            f"AWS Security Hub Findings (Last 24h): {len(rows)} new finding(s)",
52            f"[https://{config['aws'].get('region')}.console.aws.amazon.com/securityhub/home?region=eu-west-1#/findings]",
53            table,
54        ]
55
56    return "\n".join(lines)